SBOM Implementation Reality - the SPDX Lite Profile for First Step
summary
Introduces SPDX Lite as a minimal subset of SPDX 3.0 that mandates key license fields and a package-centric minimum to let low‑maturity companies produce useful SBOMs quickly, provides concrete GitHub JSON examples and mapping sheets that compare SPDX/CycloneDX to NT minimum elements, telecom, medical and PCI guidance, and shows practical gaps (no generator tool yet) while validating that the profile captures the handful of fields security and compliance teams actually need.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:19SPDX Light purpose
- 6:15SBOM adoption challenges
- 9:35Process management & OpenChain
- 12:30SPDX Light design principles
- 16:31SPDX Light data structure
- 18:40SBOM regulations & guidelines
- 22:45SBOM elements comparison
- 29:06SBOM maturity models
- 30:55OpenChain SBOM study group
- 33:58Q&A
related talks
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
27mSBOM: The Rest Of the Story
41mThe State of SBoMs in Embedded
42mPractical SBOM Management with Zephyr and SPDX
29mThe Current State of SBOMs for End Users
42mPractical SBOM Management with Zephyr and SPDX
20mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Sce...